Is a Deleted File Really Gone?

Summary

Areas of Science

Computer Science
Cybersecurity

Difficulty

Method

Scientific Method

Time Required

Short (2-5 days)

Prerequisites

You should be comfortable using a computer.

Material Availability

External hard disk drive (HDD) required.

Cost

Very Low (under $20)

Safety

No issues

Credits

Sandra Slutz, PhD, Science Buddies Alumni

Science Buddies is committed to creating content authored by scientists and educators. Learn more about our process and how we use AI.

Abstract

When you delete a file, by accident or on purpose, is the information really gone? Can you get it back? If you accidentally deleted your five-page report for school, you may be hoping it is not really gone. On the other hand, if you do not want someone to get their hands on the goofy and unflattering pictures you and your best friend took while staying up late the other night, you probably hope the files you deleted are gone for good!

Computer experts are often asked about file recovery. Sometimes questions come from frantic students who accidentally deleted a long, hard-to-write paper. Sometimes questions come from police officers or lawyers working on a criminal case. In a criminal case, it is the job of a forensic computer analyst to find out the answer. The analyst uses sophisticated tools to carefully and painstakingly look through a suspect's computer to recover evidence from saved files—including files the suspect thought they deleted. In this project, you will experiment with searching for and recovering files that may or may not have been deleted and explore various deletion techniques.

Before you get started, you need to understand how data is stored on different types of drives or systems. The way data is stored on and retrieved from hard-disk drives (HDDs) is different from how data is stored on solid-state drives (SSDs) or in the cloud. The suggestions below for designing a project are specific to HDDs, but you could design a project to test deletion on SSDs or explore what happens to files stored in the cloud. 

Note: We recommend working with an external USB HDD, separate from your computer's main hard drive, in order to avoid the risk of data loss or accidentally erasing your computer's main hard drive.

When a file is saved to a computer's hard-disk drive, the file is stored in multiple sections, called clusters. The number of clusters that the file takes up depends on how much information is in the file. The more information, the larger the file, and the more space it takes on the hard drive. The computer only saves a file to clusters of the hard drive that it thinks of as "empty." It also creates a record of where it stores the file in a large table. The table tells the computer what files are stored where. In Figure 1, you can see an illustration of a book report stored across several clusters of a hard drive with empty hard drive space on either side.

Image Credit: Sandra Slutz, Science Buddies / Science Buddies

Data that is stored on a hard drive is spread across small groups called clusters. Twelve squares are lined up and represent sections of a hard drive where data can be saved. The first three squares are empty, the next seven squares contain the data for a book report and are colored green, and the final two squares are empty. Data for files do not necessarily have to be saved in clusters that are physically next to each other, but they are in this example.

Figure 1. Files, like this book report, are stored in multiple clusters on the hard drive. Clusters next to a file can be empty or filled with a different file. The clusters that store a file do not all have to be physically next to each other.

If you select a file and press the delete button (or use the system menu to delete it), the file will go into a folder named Trash if you are using a Mac, or Recycle Bin if you are using a Windows computer. Emptying the Trash/Recycle Bin (if you do not know how to do this, ask an adult who is comfortable using computers or do an internet search on "how to empty my computer's Trash/Recycle Bin") tells the computer to get rid of the table entry that says what the file is called and where it is stored on the hard drive. It also signals to the computer that it should think of those clusters as "empty" again, even if there is information sitting in them.

Once the computer thinks of the hard drive clusters as "empty," it can store other files in those spaces by writing over the information that was previously there. Figure 2 shows an example of this. Once the book report was deleted, the computer stored other files in the same space. Notice that not all of the clusters were written over. This is a matter of luck. If a smaller file, like the photo in the example shown in Figure 2, is stored in the same space that a larger file, like the book report, used to take up, several of the clusters next to it may not be overwritten.

Image Credit: Sandra Slutz, Science Buddies / Science Buddies

Twelve squares represent areas on a hard drive where data can be saved. When a file is deleted, the data in the square isn't erased but it is allowed to be over-written with new data. In this example the first three squares contain data for a science fair data table, the next seven squares used to be all green and contain the data for a book report but now two squares are green. Two squares after that are yellow and hold data for photos, the next square is green and a remenant of the deleted book report. The final four squares are blue and contain the data for a video game. Only some sections of the book report have been over-written but the clusters that weren't needed for new data are still green and contain data for the deleted book report.

Figure 2. Once a file is deleted, the file system manager allows the hard drive clusters to be overwritten with new files.

Using data recovery tools that look at whether a hard drive cluster is truly empty or not, forensic computer analysts can sometimes retrieve all or parts of a file if it has not been written over. Sometimes people deliberately write over a file to keep the data secret. This is called overwriting or file shredding, and there are tools to do this, too. Is it possible to recover these files?

To explore file deletion, shredding, and recovery for a science project, you can try "recovering" different tiers of files on a computer (again, we recommend using an external HDD, to avoid any accidental data loss on your main hard drive from a file shredding program). For example, try to recover: 

• Files that have been deleted, without emptying the drive's Trash or Recycle Bin

• Files that have been deleted, after emptying the drive's Trash or Recycle Bin (You will need to look up instructions for your operating system and what happens when you delete a file on an external drive, which may have its own trash/recycle bin separate from the one on the main hard drive.)

• Files that have been overwritten/shredded using a file shredding program (Search online for a program that works for your operating system.) 

For an added challenge, you might have someone else hide/delete/shred files on a drive, then you act as the forensic expert to try and find or recover them.

Alternatively, you might explore how file storage, deletion, and recovery work on solid-state drives or cloud storage services like Google Drive. What happens when you delete files from an SSD or from a cloud-based system? Can you (or someone else) recover them? What about files that are stored locally and also backed up to a cloud service, like pictures stored on your phone that are backed up to iCloud or Google Photos?

Ask an Expert

Do you have specific questions about your science project? Our team of volunteer scientists can help. Our Experts won't do the work for you, but they will make suggestions, offer guidance, and help you troubleshoot.

Post a Question

Global Goals

The United Nations Sustainable Development Goals (UNSDGs) are a blueprint to achieve a better and more sustainable future for all.

This project explores topics key to Industry, Innovation and Infrastructure: Build resilient infrastructure, promote sustainable industrialization and foster innovation.

Careers

If you like this project, you might enjoy exploring these related careers:

Computer Hardware Engineer

Log in to add favorite More Menu

• Read More

Career Profile

Whether you are playing video games, surfing the Internet, or writing a term paper, computers are an integral part of our daily lives. Computer hardware engineers work to make computers faster, more robust, and more cost-effective. They design the microprocessor chips that make your computer function, along with the equipment that makes computing easy and fun to do. Read more

Information Security Analyst

Log in to add favorite More Menu

• Read More

Career Profile

Have you ever seen a story on the news about how a company or government agency was "hacked" and people's personal information, like names, addresses, or credit card numbers, was stolen? It is an information security analyst's job to prevent that from happening. Organizations hire information security analysts to analyze possible threats against their computer systems, which can range from malicious hackers trying to steal data to careless employees who accidentally forget to log out of a… Read more

Security Incident Responder

Log in to add favorite More Menu

• Read More

Career Profile

Security incident responders, also called intrusion analysts or incident response engineers, are like the "firefighters" of the cyber world. Companies can take steps to safeguard their computer networks and systems, but sometimes prevention is not enough and cyber attacks still happen. Sensitive data like customer credit card information can be stolen, entire websites could be brought down or altered, or personal contact information can be leaked. When this happens, incident responders must act… Read more

News Feed on This Topic

 

, ,

Explore Our Science Videos

Create a Facial Recognition Model That Can Recognize Your Face

Bending Plant Roots with Gravity | STEM Lesson Plan

Make a Whirlybird from Paper | STEM Activity